CVSS 3.1
6.5 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NCVE-2022-31150
Medium (6.5) in nodejs undici. EPSS 1.5% chance of exploitation in the next 30 days. Fixed in undici 5.8.0.
undici is an HTTP/1.1 client, written from scratch for Node.js. It is possible to inject CRLF sequences into request headers in undici in versions less than 5.7.1. A fix was released in version 5.8.0. Sanitizing all HTTP headers from untrusted sources to eliminate `\r\n` is a workaround for this issue.
Severity
- EPSS
- 1.5% chance of exploitation in the next 30 days; higher than 74% of CVEs (scores of 2026-10-31)
- CWE
- CWE-93
- Published
- Modified
- Record from
- the NVD, synced
Affected
- nodejs:undici
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-3cvr-822r-rqcc | npm | undici | <5.8.0 | 5.8.0 |